openapi: 3.2.0 info: title: Mist Sites Networks API description: '> Version: **2607.1.1** > > Date: **August 17, 2026** NOTE: Some important API changes will be introduced.' contact: name: Thomas Munzer email: tmunzer@juniper.net version: 2607.1.1 servers: - url: https://api.mist.com variables: {} - url: https://api.gc1.mist.com variables: {} - url: https://api.ac2.mist.com variables: {} - url: https://api.gc2.mist.com variables: {} - url: https://api.gc4.mist.com variables: {} - url: https://api.eu.mist.com variables: {} - url: https://api.gc3.mist.com variables: {} - url: https://api.ac6.mist.com variables: {} - url: https://api.gc6.mist.com variables: {} - url: https://api.ac5.mist.com variables: {} - url: https://api.gc5.mist.com variables: {} - url: https://api.gc7.mist.com variables: {} security: - apiToken: [] - csrfToken: [] tags: - name: Sites Networks description: The API Endpoints for the Networks at the site level can be used to get the site derived networks, meaning the org level configuration with the site variables resolved. paths: /api/v1/sites/{site_id}/networks/derived: parameters: [] get: tags: - Sites Networks summary: listSiteNetworksDerived description: Get the list of derived Networks for a Site operationId: listSiteNetworksDerived parameters: - name: site_id in: path description: '' required: true schema: type: string contentEncoding: uuid examples: - 000000ab-00ab-00ab-00ab-0000000000ab - name: resolve in: query description: Whether resolve the site variables style: form explode: true schema: type: boolean default: false responses: '200': description: OK headers: {} content: application/json: schema: type: array items: $ref: '#/components/schemas/network' description: List of organization network definitions examples: - - created_time: 0 disallow_mist_services: false gateway: 192.168.70.1 hosts: property1: external_ips: 172.16.10.32-172.16.10.35 ips: 192.168.70.32-192.168.70.35 property2: external_ips: 172.16.10.32-172.16.10.35 ips: 192.168.70.32-192.168.70.35 id: 497f6eca-6276-4993-bfeb-53cbbbba6f13 internal_access: enabled: true internet_access: create_simple_service_policy: false destination_nat: property1: internal_ip: 192.168.70.30 name: web server port: '443' property2: internal_ip: 192.168.70.30 name: web server port: '443' enabled: true restricted: false static_nat: property1: internal_ip: 192.168.70.3 name: printer-1 property2: internal_ip: 192.168.70.3 name: printer-1 isolation: true modified_time: 0 name: string org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b subnet: 192.168.70.0/24 tenants: property1: addresses: - 10.10.10.10 property2: addresses: - 10.10.10.45 vlan_id: 10 vpn_access: property1: allow_ping: true destination_nat: property1: internal_ip: 192.168.70.5/30 name: web server port: '443' property2: internal_ip: 192.168.70.5/30 name: web server port: '443' nat_pool: 172.16.0.0/26 routed: true source_nat: external_ip: 172.16.0.8/30 static_nat: property1: internal_ip: 192.168.70.3 name: pos_station-1 property2: internal_ip: 192.168.70.3 name: pos_station-1 summarized_subnet: 172.16.0.0/16 property2: allow_ping: true destination_nat: property1: internal_ip: 192.168.70.5/30 name: web server port: '443' property2: internal_ip: 192.168.70.5/30 name: web server port: '443' nat_pool: 172.16.0.0/26 routed: true source_nat: external_ip: 172.16.0.8/30 static_nat: property1: internal_ip: 192.168.70.3 name: pos_station-1 property2: internal_ip: 192.168.70.3 name: pos_station-1 summarized_subnet: 172.16.0.0/16 contentMediaType: application/json examples: Example: value: - created_time: 0 disallow_mist_services: false gateway: 192.168.70.1 hosts: property1: external_ips: 172.16.10.32-172.16.10.35 ips: 192.168.70.32-192.168.70.35 property2: external_ips: 172.16.10.32-172.16.10.35 ips: 192.168.70.32-192.168.70.35 id: 497f6eca-6276-4993-bfeb-53cbbbba6f13 internal_access: enabled: true internet_access: create_simple_service_policy: false destination_nat: property1: internal_ip: 192.168.70.30 name: web server port: '443' property2: internal_ip: 192.168.70.30 name: web server port: '443' enabled: true restricted: false static_nat: property1: internal_ip: 192.168.70.3 name: printer-1 property2: internal_ip: 192.168.70.3 name: printer-1 isolation: true modified_time: 0 name: string org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b subnet: 192.168.70.0/24 tenants: property1: addresses: - 10.10.10.10 property2: addresses: - 10.10.10.45 vlan_id: 10 vpn_access: property1: allow_ping: true destination_nat: property1: internal_ip: 192.168.70.5/30 name: web server port: '443' property2: internal_ip: 192.168.70.5/30 name: web server port: '443' nat_pool: 172.16.0.0/26 routed: true source_nat: external_ip: 172.16.0.8/30 static_nat: property1: internal_ip: 192.168.70.3 name: pos_station-1 property2: internal_ip: 192.168.70.3 name: pos_station-1 summarized_subnet: 172.16.0.0/16 property2: allow_ping: true destination_nat: property1: internal_ip: 192.168.70.5/30 name: web server port: '443' property2: internal_ip: 192.168.70.5/30 name: web server port: '443' nat_pool: 172.16.0.0/26 routed: true source_nat: external_ip: 172.16.0.8/30 static_nat: property1: internal_ip: 192.168.70.3 name: pos_station-1 property2: internal_ip: 192.168.70.3 name: pos_station-1 summarized_subnet: 172.16.0.0/16 application/vnd.api+json: schema: type: array items: $ref: '#/components/schemas/network' description: List of organization network definitions examples: - - created_time: 0 disallow_mist_services: false gateway: 192.168.70.1 hosts: property1: external_ips: 172.16.10.32-172.16.10.35 ips: 192.168.70.32-192.168.70.35 property2: external_ips: 172.16.10.32-172.16.10.35 ips: 192.168.70.32-192.168.70.35 id: 497f6eca-6276-4993-bfeb-53cbbbba6f13 internal_access: enabled: true internet_access: create_simple_service_policy: false destination_nat: property1: internal_ip: 192.168.70.30 name: web server port: '443' property2: internal_ip: 192.168.70.30 name: web server port: '443' enabled: true restricted: false static_nat: property1: internal_ip: 192.168.70.3 name: printer-1 property2: internal_ip: 192.168.70.3 name: printer-1 isolation: true modified_time: 0 name: string org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b subnet: 192.168.70.0/24 tenants: property1: addresses: - 10.10.10.10 property2: addresses: - 10.10.10.45 vlan_id: 10 vpn_access: property1: allow_ping: true destination_nat: property1: internal_ip: 192.168.70.5/30 name: web server port: '443' property2: internal_ip: 192.168.70.5/30 name: web server port: '443' nat_pool: 172.16.0.0/26 routed: true source_nat: external_ip: 172.16.0.8/30 static_nat: property1: internal_ip: 192.168.70.3 name: pos_station-1 property2: internal_ip: 192.168.70.3 name: pos_station-1 summarized_subnet: 172.16.0.0/16 property2: allow_ping: true destination_nat: property1: internal_ip: 192.168.70.5/30 name: web server port: '443' property2: internal_ip: 192.168.70.5/30 name: web server port: '443' nat_pool: 172.16.0.0/26 routed: true source_nat: external_ip: 172.16.0.8/30 static_nat: property1: internal_ip: 192.168.70.3 name: pos_station-1 property2: internal_ip: 192.168.70.3 name: pos_station-1 summarized_subnet: 172.16.0.0/16 contentMediaType: application/vnd.api+json examples: Example: value: - created_time: 0 disallow_mist_services: false gateway: 192.168.70.1 hosts: property1: external_ips: 172.16.10.32-172.16.10.35 ips: 192.168.70.32-192.168.70.35 property2: external_ips: 172.16.10.32-172.16.10.35 ips: 192.168.70.32-192.168.70.35 id: 497f6eca-6276-4993-bfeb-53cbbbba6f13 internal_access: enabled: true internet_access: create_simple_service_policy: false destination_nat: property1: internal_ip: 192.168.70.30 name: web server port: '443' property2: internal_ip: 192.168.70.30 name: web server port: '443' enabled: true restricted: false static_nat: property1: internal_ip: 192.168.70.3 name: printer-1 property2: internal_ip: 192.168.70.3 name: printer-1 isolation: true modified_time: 0 name: string org_id: a40f5d1f-d889-42e9-94ea-b9b33585fc6b subnet: 192.168.70.0/24 tenants: property1: addresses: - 10.10.10.10 property2: addresses: - 10.10.10.45 vlan_id: 10 vpn_access: property1: allow_ping: true destination_nat: property1: internal_ip: 192.168.70.5/30 name: web server port: '443' property2: internal_ip: 192.168.70.5/30 name: web server port: '443' nat_pool: 172.16.0.0/26 routed: true source_nat: external_ip: 172.16.0.8/30 static_nat: property1: internal_ip: 192.168.70.3 name: pos_station-1 property2: internal_ip: 192.168.70.3 name: pos_station-1 summarized_subnet: 172.16.0.0/16 property2: allow_ping: true destination_nat: property1: internal_ip: 192.168.70.5/30 name: web server port: '443' property2: internal_ip: 192.168.70.5/30 name: web server port: '443' nat_pool: 172.16.0.0/26 routed: true source_nat: external_ip: 172.16.0.8/30 static_nat: property1: internal_ip: 192.168.70.3 name: pos_station-1 property2: internal_ip: 192.168.70.3 name: pos_station-1 summarized_subnet: 172.16.0.0/16 '400': description: Bad Syntax headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http400' - description: Standard HTTP 400 bad request error response examples: - detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' contentMediaType: application/vnd.api+json examples: Example: value: detail: 'JSON parse error - Expecting value: line 5 column 8 (char 56)' '401': description: Unauthorized headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/json examples: Example: value: detail: Authentication credentials were not provided. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http401' - description: Standard HTTP 401 authentication error response examples: - detail: Authentication credentials were not provided. contentMediaType: application/vnd.api+json examples: Example: value: detail: Authentication credentials were not provided. '403': description: Permission Denied headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/json examples: Example: value: detail: You do not have permission to perform this action. application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http403' - description: Standard HTTP 403 permission error response examples: - detail: You do not have permission to perform this action. contentMediaType: application/vnd.api+json examples: Example: value: detail: You do not have permission to perform this action. '404': description: Not found. The API endpoint doesn’t exist or resource doesn’ t exist headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/json application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http404' - description: Standard HTTP 404 not found error response contentMediaType: application/vnd.api+json '429': description: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold headers: {} content: application/json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold application/vnd.api+json: schema: allOf: - $ref: '#/components/schemas/response_http429' - description: Standard HTTP 429 rate limit error response examples: - detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold contentMediaType: application/vnd.api+json examples: Example: value: detail: Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold deprecated: false components: schemas: network_internet_access_destination_nat_property: title: network_internet_access_destination_nat_property type: object properties: internal_ip: type: string description: The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.30 name: type: string description: Label for this direct internet destination NAT rule examples: - web server port: type: string description: The Destination NAT destination IP address. Must be a Port (i.e. "443") or a Variable (i.e. "{{myvar}}") examples: - '443' wan_name: type: string description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity examples: - wan0 description: Direct-internet destination NAT rule target settings network_multicast_group: title: network_multicast_group type: object properties: rp_ip: type: string description: RP (rendezvous point) IP address description: Multicast group rendezvous point mapping response_http403: title: response_http403 type: object properties: detail: type: string description: Human-readable explanation of the permission error examples: - You do not have permission to perform this action. description: Standard HTTP 403 permission error response response_http400: title: response_http400 type: object properties: detail: type: string description: Human-readable explanation of the bad request error examples: - 'JSON parse error - Expecting value: line 5 column 8 (char 56)' description: Standard HTTP 400 bad request error response network_multicast2: title: network_multicast2 type: object properties: disable_igmp: type: boolean description: If the network will only be the source of the multicast traffic, IGMP can be disabled default: false enabled: type: boolean description: Whether multicast support is enabled for this network default: false groups: type: object additionalProperties: $ref: '#/components/schemas/network_multicast_group' description: Multicast group-to-RP mappings for this network description: Settings for multicast routing on this network network_vpn_access_destination_nat_property: title: network_vpn_access_destination_nat_property type: object properties: internal_ip: type: string description: The Destination NAT destination IP address. Must be an IP (i.e. "192.168.70.30") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.30 name: type: string description: Label for this VPN destination NAT rule examples: - web server port: type: string description: Destination port or variable for this VPN destination NAT rule examples: - '443' description: VPN access destination NAT rule target settings network: title: network required: - name type: object properties: created_time: type: number description: Epoch timestamp when the network was created readOnly: true disallow_mist_services: type: boolean description: Whether to disallow Mist Devices in the network default: false gateway: type: string description: IPv4 gateway address for this network contentEncoding: ipv4 examples: - 192.168.70.1 gateway6: type: string description: IPv6 gateway address for this network contentEncoding: ipv6 examples: - fdad:b0bc:f29e::1 id: type: string description: Unique identifier of the network contentEncoding: uuid readOnly: true examples: - 53f10664-3ce8-4c27-b382-0ef66432349f internal_access: allOf: - $ref: '#/components/schemas/network_internal_access2' - description: Internal access settings for this network internet_access: allOf: - $ref: '#/components/schemas/network_internet_access2' - description: Direct internet access and NAT settings for this network isolation: type: boolean description: Whether to allow clients in the network to talk to each other modified_time: type: number description: Epoch timestamp when the network was last modified readOnly: true multicast: allOf: - $ref: '#/components/schemas/network_multicast2' - description: Settings for multicast routing on this network name: type: string description: Display name of the organization network org_id: type: string description: Organization that owns this network contentEncoding: uuid readOnly: true examples: - a97c1b22-a4e9-411e-9bfd-d8695a0f9e61 routed_for_networks: type: array items: type: string description: Other network names this network can route to, for example through BGP, OSPF or static routes subnet: type: string description: IPv4 subnet CIDR for this network examples: - 192.168.70.0/24 subnet6: type: string description: IPv6 subnet CIDR for this network examples: - fdad:b0bc:f29e::/32 tenants: type: object additionalProperties: $ref: '#/components/schemas/network_tenant' description: Tenant address mappings associated with this network vlan_id: oneOf: - type: string - maximum: 4094 minimum: 1 type: integer contentEncoding: int32 description: VLAN ID or variable associated with this network vpn_access: type: object additionalProperties: $ref: '#/components/schemas/network_vpn_access_config' description: VPN access settings keyed by VPN name for this network description: Organization-level Layer 3 network definition that can be merged into site settings and used for service routes. Networks are used to define the service routes in the Gateway settings or templates response_http404: title: response_http404 type: object properties: id: type: string description: Missing resource identifier, when the API includes one description: Standard HTTP 404 not found error response network_source_nat2: title: network_source_nat2 type: object properties: external_ip: type: string description: External source NAT IP or subnet used when spoke hosts must be reachable from the hub examples: - 172.16.0.8/30 description: Source NAT settings used when non-routed spoke hosts must be reachable from the hub network_internet_access_static_nat_property: title: network_internet_access_static_nat_property type: object properties: internal_ip: type: string description: The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.3 name: type: string description: Label for this direct internet static NAT rule examples: - pos_station-1 wan_name: type: string description: SRX Only. If not set, we configure the nat policies against all WAN ports for simplicity. Can be a Variable (i.e. "{{myvar}}") examples: - wan0 description: Direct-internet static NAT rule target settings response_http401: title: response_http401 type: object properties: detail: type: string description: Human-readable explanation of the authentication error examples: - Authentication credentials were not provided. description: Standard HTTP 401 authentication error response response_http429: title: response_http429 type: object properties: detail: type: string description: Human-readable explanation of the rate limit error examples: - Too Many Request. The API Token used for the request reached the 5000 API Calls per hour threshold description: Standard HTTP 429 rate limit error response network_internet_access2: title: network_internet_access2 type: object properties: create_simple_service_policy: type: boolean description: Whether Mist should create simple service policies for restricted internet access default: false destination_nat: type: object additionalProperties: $ref: '#/components/schemas/network_internet_access_destination_nat_property' description: Destination NAT rules for direct internet access enabled: type: boolean description: Whether direct internet access is enabled for this network restricted: type: boolean description: By default, all access is allowed, to only allow certain traffic, make `restricted`=`true` and define service_policies default: false static_nat: type: object additionalProperties: $ref: '#/components/schemas/network_internet_access_static_nat_property' description: Static NAT rules for direct internet access description: Direct internet access and NAT settings for this network network_internal_access2: title: network_internal_access2 type: object properties: enabled: type: boolean description: Whether internal access is enabled for this network description: Internal access settings for this network network_vpn_access_config: title: network_vpn_access_config type: object properties: advertised_subnet: type: string description: If `routed`==`true`, whether to advertise an aggregated subnet toward HUB this is useful when there are multiple networks on SPOKE's side examples: - 172.16.0.0/24 allow_ping: type: boolean description: Whether to allow ping from vpn into this routed network destination_nat: type: object additionalProperties: $ref: '#/components/schemas/network_vpn_access_destination_nat_property' description: Destination NAT rules applied for VPN access to this network nat_pool: type: string description: If `routed`==`false` (usually at Spoke), but some hosts needs to be reachable from Hub, a subnet is required to create and advertise the route to Hub examples: - 172.16.0.0/26 no_readvertise_to_lan_bgp: type: boolean description: toward LAN-side BGP peers default: false no_readvertise_to_lan_ospf: type: boolean description: toward LAN-side OSPF peers default: false no_readvertise_to_overlay: type: boolean description: toward overlay, how HUB should deal with routes it received from Spokes other_vrfs: type: array items: type: string description: Other VRFs that can receive leaked routes from this spoke network routed: type: boolean description: Whether this network is routable source_nat: allOf: - $ref: '#/components/schemas/network_source_nat2' - description: Source NAT settings used when non-routed spoke hosts must be reachable from the hub static_nat: type: object additionalProperties: $ref: '#/components/schemas/network_vpn_access_static_nat_property' description: Static NAT rules applied for VPN access to this network summarized_subnet: type: string description: toward overlay, how HUB should deal with routes it received from Spokes examples: - 172.16.0.0/16 summarized_subnet_to_lan_bgp: type: string description: toward LAN-side BGP peers examples: - 172.16.0.0/16 summarized_subnet_to_lan_ospf: type: string description: toward LAN-side OSPF peers examples: - 172.16.0.0/16 description: VPN access settings for a network and VPN pair network_vpn_access_static_nat_property: title: network_vpn_access_static_nat_property type: object properties: internal_ip: type: string description: The Static NAT destination IP address. Must be an IP address (i.e. "192.168.70.3") or a Variable (i.e. "{{myvar}}") examples: - 192.168.70.3 name: type: string description: Label for this VPN static NAT rule examples: - pos_station-1 description: VPN access static NAT rule target settings network_tenant: title: network_tenant type: object properties: addresses: type: array items: type: string description: IP addresses or subnets assigned to this tenant in the network description: Tenant address entry for a network securitySchemes: apiToken: type: apiKey description: "Preferred authentication method for automation and integrations. Send the API token in the HTTP `Authorization` header.\n\n**Format**:\n `Authorization: Token {apitoken}`\n\n**Notes**:\n* An API token generated for a specific admin has the same privileges as that admin\n* An API token is automatically removed if it is not used for more than 90 days\n* SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed." name: Authorization in: header csrfToken: type: apiKey description: 'Session-based authentication for browser or login/password flows. After a successful [Login]($e/Admins%20Login/login) request, Mist returns a `csrftoken` cookie. Send that value in the `X-CSRFToken` header on later API requests that use the login session. **Format**: ``` X-CSRFToken: vwvBuq9qkqaKh7lu8tNc0gkvBfEaLAmx ``` For automation, API Token authentication is preferred.' name: X-CSRFToken in: header